Cookie Consent for US-Only Sites: What You Still Need Without EU Traffic
A site owner with no European traffic asked whether the banner could come down. The traffic was all American, the analytics were first-party, and the GDPR did not apply. The answer was no, and the reason was not the GDPR. California, Colorado, Connecticut, and a growing list of other states have their own privacy laws, and they do not care where your server sits. If a Californian visits your site, California law visits with them.
US-only does not mean consent-free. It means a different set of rules, and a banner built for the GDPR will get some of them wrong. The American rules are opt-out rules, not opt-in rules, and they turn on signals and links rather than on a consent gate.
The laws that still apply
The California Consumer Privacy Act, as amended by the CPRA, is the one that matters most, because California is the largest state and the law reaches any business that does business in California and meets its thresholds. It gives residents the right to opt out of the sale or sharing of their personal information, the right to know what is collected, and the right to limit the use of sensitive personal information. Other states have followed with their own versions, and the list grows every year.
The practical difference from the GDPR is the direction of the choice. Under the GDPR, nothing non-essential happens until the visitor says yes. Under the California rules, the processing can happen until the visitor says stop. That sounds easier, and in some ways it is, but the opt-out has to be real: easy to find, easy to use, and honored promptly.
The signal you cannot ignore
The Global Privacy Control signal is a browser setting that tells a site the visitor wants to opt out. California requires businesses to honor it, and the January 2026 regulations added teeth: the site has to display whether it processed the opt-out signal, and confirm the opt-out within 15 business days. A site that ignores GPC is ignoring a legally valid opt-out, and the regulator has said so in plain terms.
Test it. Turn on GPC in a test browser, visit the site, and see what happens. The check takes two minutes. Most US-only sites fail it, because nobody ever wired the signal to anything. The fix is usually small: read the Sec-GPC header, flip the sale and sharing flags, and show the visitor that it worked.
What a US-only banner needs
A US-only site still needs a do-not-sell link, and the link has to do real work. The exact title is Do Not Sell or Share My Personal Information, it belongs in the footer in the first row, and it has to carry the same weight as the other links there. Clicking it has to open a working opt-out, not a page that explains the concept. And the opt-out has to take effect: the sale and sharing flags flip, and the visitor is not asked again for 12 months.
The banner itself can be simpler than a GDPR banner. It does not need to gate tags before consent, because the American rules do not require prior consent. It does need to tell the visitor what is collected, link to the privacy notice, and make the opt-out obvious. A banner that only says this site uses cookies, with no link to anything, is a decoration.
One more thing to check: the analytics. First-party analytics that never leaves your own systems is low risk under the state laws. The moment that data goes to an ad network, a data broker, or a cross-context behavioral advertising partner, the sale and sharing rules apply, and the opt-out has to cover it. The question is not what tool you use. It is where the data goes.
Keep reading: what a cookie scan misses after a redesign, and how the banner changes after the EAA cover the nearby cases in this series.
Frequently asked questions
Does the GDPR apply if I have no European visitors?
No. The GDPR applies to the personal data of people in the European Economic Area. If you genuinely have no European traffic, it does not reach you. But state privacy laws in the US do apply, and California law reaches any business that does business in California and meets its thresholds.
What is the GPC signal and do I have to honor it?
Global Privacy Control is a browser setting that tells a site the visitor wants to opt out of sale and sharing. California requires businesses to honor it, and the January 2026 regulations require the site to display whether the signal was processed and confirm the opt-out within 15 business days.
Do I need a do-not-sell link if I never sell data?
If you share data for cross-context behavioral advertising, California treats that as sharing, and the link is required. The exact title is Do Not Sell or Share My Personal Information. If you truly never sell or share, the link is not required, but the definition of sharing is broad, so check where your data actually goes.
Can a US-only site use a simpler banner than a GDPR site?
Yes. American rules are opt-out rules, so the banner does not need to gate tags before consent. It does need to tell the visitor what is collected, link to the privacy notice, and make the opt-out obvious. A banner that only says the site uses cookies, with no link, is a decoration.